How do I install coreboot on the x230?

General Discussion
1

I want to install coreboot because it seems to be officially recommended by QubesOS, but I have no idea how to do it.
If anyone has installed it, please let me know. I don’t have a Raspberry Pi, do I need one?

1 Like
2

If you don’t have an eprom programmer or Raspberry Pie, then you can use the 1vyrain firmware to install coreboot.

It’s relatively safe to use 1vyrain, but without any way to externally flash the rom you have no way to recover if something goes wrong.

3

Before you do anything. Make a decision as to whether you just want Core Boot. Or If you intend to use Heads.

Heads being the feature, use a Nitro Key or Librem Key to verify that the computer has not been tampered with. Installing Heads requires that one open the laptop and do a hardware Flash of the Chips. GitHub - merge/skulls: pre-built coreboot images and documentation on how to flash them for Thinkpad Laptops

I say that because, if one has already applied 1vyrain, it might not be possible to do the hardware Flash without gorking the MOBO.

Notice also that one must be careful as to which Intel BIOS/EFI is installed before installing either one of these things.

I read there is a another program that is called 'Anti-Evil Maid" and I know nothing about it. If it works, and can work with 1vyrain.

So do a bit of survey first as to what you want to be like when you finish.

I am hoping someone will come along now and talk about actually installing and using “Anti-Evil Maid” on a Lenovo X230. Or the difficulty of keeping the encrypted key using Heads properly set (updated) , to verify that the computer has not been tampered with.

Just found: TrenchBoot Anti Evil Maid for Qubes OS

4

How is 1vyrain going to prevent you from externally flashing the rom?

It’s just an eprom I don’t see how there is any way to prevent someone from flashing it with an external programmer.

5

I agree. It does not look to matter. Well. I had to roll back BIOS/EFI before attempting the hardware Flash. BIOS/EFI rollback seemed to work.

Wanna tell me how I bricked my X-230. I should be able to write over the problem with the Programmer. I stopped trying at twenty tries. I guess I am too clumsy with putting the Clip on. Might be the magnetics of the florescent lights.

6

I have had 3 of the cheap black clips break, if I should guess it’s the clip that is the problem.

The big spring that closes the clip and the small springs in the pin connector eventually get too soft, and the clip stops having a good connection with the chip.

7

Observations from those who have been successful in this are important.

I also saw a website which suggested it is easy to rub off a resistor, which keeps the computer from booting.

Renehoj, if you live close to east Texas and can be bribed to fix up an X-230. I have the problem X-230, and, in addition, I bought another MOBO to put in it.

I already bought a functional X-230, which I am afraid to tamper with. I have not broken it yet. I was thinking of the other route. Beginning with what you suggested: 1vyrain. and then the “Anti-Evil Maid.”

8

I don’t live in the US.

I think it’s very unlikely you have damaged the motherboard, you are only going to rub off a resistor if there is something wrong with the solder joint.

Try ordering a new clip and see if that fixes the problem.

1 Like
9

Instead of the clip order some real probes/hooks.

https://sigrok.org/wiki/Probe_comparison

1 Like
10

I had thought of Clips would be better as well.

Also spending a hundred and buying PI to be the programmer. Or are they more now.

I am 72, have some vision issues, and really poor.

As I think of it. It is surely easier for me to go the route of 1vyrain, and then then, “Anti-Evil Maid” would seem as good as using Heads. Or is it? Is it as reliable for detecting problems?

11

You cannot (currently) use Anti-Evil Maid if you have flashed the chip
with coreboot, and cleaned ME.
AEM is as reliable as Heads for authenticating the machine to the user.

I never presume to speak for the Qubes team. When I comment in the Forum or in the mailing lists I speak for myself.
1 Like
12

Does ME disappear after flashing coreboot?

1 Like
13

You can configure coreboot to clean ME, but you need not.
You can use me_cleaner without applying coreboot.

ME is cleaned, but does not “disappear” on these machines. Some modules
are required for boot, but ME then errors and does not work. (On much
older machines, ME is completely removed by me_cleaner.)

1 Like
14

Thank you, what about Skulls, is it easier than installing coreboot?

1 Like
15

@7530hhmu I highly recommend Skulls! Skulls is far easier than compiling your own Coreboot package, coming from a novice here. I have flashed Skulls on several X230 and T430 models and successfully updated them to newer versions of Skulls without any issues. Martin Kepplinger, the maintainer for Skulls, is also very quick to answer questions and concerns.

16

Like the Thinkpad X200 ?

17

Can you drop some links regarding Skulls?

18

As I was told, the difference between CoreBoot and Skulls is that Skulls installs the latest version of Core Boot, else you must look up the latest version of Core Boot for your computer, and compile it.

Might be wise to read some of the things written by Martin Kipplinger. I frankly have not. My bad.

1 Like
19

Yes, you can completely remove ME on the x200 and similar models, but
you cant run Qubes on them.

1 Like
20

How did you do the installation? Raspberry Pi or 1vyrain?

1 Like